{"containers": {"cna": {"affected": [{"product": "SEMA API", "vendor": "Unknown", "versions": [{"lessThan": "4.02", "status": "affected", "version": "4.02", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "cydave"}], "descriptions": [{"lang": "en", "value": "The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX action, leading to SQL Injections exploitable by unauthenticated users"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 SQL Injection", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-06T08:50:52", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wpscan.com/vulnerability/2a226ae8-7d9c-4f47-90af-8a399a08f03f"}], "source": {"discovery": "EXTERNAL"}, "title": "SEMA API < 4.02 - Unauthenticated SQLi", "x_generator": "WPScan CVE Generator", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "contact@wpscan.com", "ID": "CVE-2022-0836", "STATE": "PUBLIC", "TITLE": "SEMA API < 4.02 - Unauthenticated SQLi"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SEMA API", "version": {"version_data": [{"version_affected": "<", "version_name": "4.02", "version_value": "4.02"}]}}]}, "vendor_name": "Unknown"}]}}, "credit": [{"lang": "eng", "value": "cydave"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX action, leading to SQL Injections exploitable by unauthenticated users"}]}, "generator": "WPScan CVE Generator", "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-89 SQL Injection"}]}]}, "references": {"reference_data": [{"name": "https://wpscan.com/vulnerability/2a226ae8-7d9c-4f47-90af-8a399a08f03f", "refsource": "MISC", "url": "https://wpscan.com/vulnerability/2a226ae8-7d9c-4f47-90af-8a399a08f03f"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:40:04.488Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wpscan.com/vulnerability/2a226ae8-7d9c-4f47-90af-8a399a08f03f"}]}]}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2022-0836", "datePublished": "2022-05-09T16:50:37", "dateReserved": "2022-03-03T00:00:00", "dateUpdated": "2024-08-02T23:40:04.488Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:semadatacoop:sema_api:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "A602A0A2-5F84-415C-B659-CA2D70670557", "versionEndExcluding": "4.02", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX action, leading to SQL Injections exploitable by unauthenticated users"}, {"lang": "es", "value": "El plugin SEMA API WordPress anterior a la versi\u00f3n 4.02 no sanea y escapa correctamente de algunos par\u00e1metros antes de utilizarlos en sentencias SQL a trav\u00e9s de una acci\u00f3n AJAX, lo que da lugar a inyecciones SQL explotables por usuarios no autentificados"}], "id": "CVE-2022-0836", "lastModified": "2022-10-14T12:55:02.567", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-09T17:15:08.460", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/2a226ae8-7d9c-4f47-90af-8a399a08f03f"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "contact@wpscan.com", "type": "Primary"}]}

{}